metamask[.]framer[.]media

The domain metamask.framer.media was registered on November 19, 2021 through CSC Corporate Domains, Inc. It resolves to the Amazon‑owned IP address 31.43.160.6, which is geolocated to the Netherlands and belongs to ASN AS16509. DNS queries return four Amazon Route 53 name servers, including ns-1267.awsdns-30.org, ns-97.awsdns-12.com and ns-1854.awsdns-39.co.uk. The site presents an HTTPS service using a Let’s Encrypt certificate issued under the E7 profile, and the TLS connection advertises HSTS and HTTP/3. A passive web‑technology survey identified Framer Sites and React as the underlying frameworks.

When accessed, the HTTP response code is 404 and the page title is "Site Not Found | Framer," indicating that the content is no longer hosted. Google Safe Browsing classifies the URL as a social‑engineering threat, and the domain appears on a single external blocklist maintained by PhishDestroy. VirusTotal analysis shows that 15 of 93 scanned security vendors flagged the domain, reinforcing the malicious assessment.

The threat is catalogued as a crypto‑scam that impersonates the MetaMask brand, a high‑risk indication for users seeking cryptocurrency wallet services. Defenders should continue to block the domain at network perimeter and endpoint controls, monitor DNS queries for the associated IP and name servers, and update internal threat‑intel feeds with the current detection metrics. Because the site is currently offline, any active credential harvesting is unlikely, but the infrastructure remains usable for future campaigns, so ongoing vigilance is advised.